Method and apparatus for testing the integrity of computer security alarm systems

• US 5,961,644 A
• Filed: 09/19/1997
• Issued: 10/05/1999
• Est. Priority Date: 09/19/1997
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Levanoni, Menachem, Kurtzberg, Jerome M.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Elmore, Stephen C.
• Application Number:
  US08/933,657
• Time in Patent Office: 746 Days
• Field of Search: 395/186, 395/187.01, 364/222.5, 364/286.4, 326/8, 380/4, 713/200, 713/201, 713/202, 714/25, 714/33, 714/41, 714/45
• US Class Current: 726/23
• CPC Class Codes: G06F 11/261 by simulating additional hardware, e.g. fault simulation
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Apparatus and method for testing the integrity of computer alarm systems which can be part of a computing network, includes testing the computer alarm system by simulating an attack on the computing network including the alarm system itself. Thereafter, information, pertaining to the status of the computing network alarm system attendant upon the simulated attack, is registered.

Claims

1. A method for testing the integrity of a computer alarm system which is one of associated with a computer and part of a computing network, the method comprising:

testing the computer alarm system by dynamically and actively simulating an attack on the computing network including the alarm system itself; and

registering information pertaining to the status of the computing network alarm system attendant upon the simulated attack during said testing.

2. The method according to claim 1, wherein a knowledge of vulnerabilities of one of said computer and said computing network are unknown prior to testing said computer alarm system.

3. The method according to claim 1, wherein said attacks are simulated on said one of said computer and said computing network to determine a performance of said computer alarm system.

4. The method according to claim 1, wherein said simulated attack comprises:

determining whether a user is attempting to log-on with a false password; and

determining a number of times said user attempts said log-on with said false password.

5. The method according to claim 4, further comprising:

when a number of attempted log-ons reaches a predetermined number, recording an error message in said register, and providing an alarm.

6. The method according to claim 1, wherein said simulated attack comprises at least one of:

determining whether a user with a legal identification and password attempts to log on, and whether said identification and said password are already in use; and

determining whether a legitimate user on the system attempts to one of access unauthorized files, and run programs which the user is not authorized to run,

wherein when any one of said identification and said password are already in use, and when the user attempts to one of access unauthorized files, and run programs which the user is not authorized to run, an error message is recorded in said register, and an alarm is provided.

7. The method according to claim 1, wherein said simulated attack comprises:

determining whether a modification has occurred of one of a program and a data files without authorization.

8. The method according to claim 7, further comprising:

when it is determined that the modification has occurred, recording an error message in said register, and providing an alarm.

9. The method according to claim 1, wherein said simulated attack comprises:

determining whether unauthorized transmission of programs or data files to another user or to another node outside the computer network, has occurred.

10. The method according to claim 9, further comprising:

when the unauthorized transmission has occurred, recording an error message in said register, and providing an alarm.

11. The method according to claim 1, wherein said testing uses a set of user IDs and passwords, and

wherein said attacks are simulated at random times, such that both a time of attack and a type of attack are generated randomly.

12. Apparatus for testing the integrity of a computer alarm system which is one of associated with a computer and part of a computing network, the apparatus comprising:

a tester for testing the computer alarm system by dynamically and actively simulating an attack on the computing network including the alarm system itself; and

a register for registering information pertinent to the status of the computing network alarm system attendant upon the simulated attack by said tester.

13. The apparatus according to claim 12, wherein said tester has a set of user IDs and passwords, and

wherein said attacks are simulated at random times, such that both a time of attack and a type of attack are generated randomly.

14. The apparatus according to claim 12, wherein said tester is embedded as a software package in one of said computer system and in all nodes of the computing network.

15. The apparatus according to claim 12, wherein said tester and said security alarm system are on line, and operate in real time.

16. The apparatus according to claim 12, said tester includes a set of pairs of elements comprising at least one group of paired first and second elements,

said first element representing a type of attack to occur, and said second element representing a random time at which the attack is to occur.

17. The apparatus according to claim 16, wherein each group of paired first and second elements is dynamically generated, with a record of it supplied to the register.

18. The apparatus according to claim 16, wherein an entire set of pairs is supplied in advance.

19. The apparatus according to claim 12, wherein a knowledge of vulnerabilities of one of said computer and said computing network are unknown by said tester prior to testing dynamically and actively said computer alarm system.

20. The apparatus according to claim 12, wherein said attacks by said tester are simulated on said one of said computer and said computing network to determine a performance of the alarm system.